---
id: "CVE-2026-63132"
kind: "vulnerability"
aliases: ["CVE-2026-63132", "GHSA-34fc-gh42-pj53", "GO-2026-6553"]
title: "OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao"
severity: "critical"
cvss: 9.2
epss: 0.00497
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/openbao/openbao", "fixed": ["0.0.0-20260713141742-763625a20721"], "affected": ">= 0.1.0, < 0.0.0-20260713141742-763625a20721", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "openbao", "package", "secrets-management", "self-hosted"]
not_affected_if: ["managed-hosting", "recovery-mode-disabled"]
published_at: "2026-09-23T19:17:34+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:43:45+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6553", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-63132", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63132", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack in github.com/openbao/openbao

OpenBao's recovery mode endpoint compares the recovery token with ordinary string equality, which leaks timing information. A remote unauthenticated attacker who measures response times can recover the recovery token and then read or modify OpenBao data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/openbao/openbao affected >= 0.1.0, < 0.0.0-20260713141742-763625a20721 fixed 0.0.0-20260713141742-763625a20721

## How to check

Check the OpenBao version with the bao version command or the go.mod entry for github.com/openbao/openbao; versions before 2.6.0 (or pseudo-version before 0.0.0-20260713141742-763625a20721) are affected.

## Fix

Upgrade github.com/openbao/openbao to 2.6.0 or later (pseudo-version 0.0.0-20260713141742-763625a20721).
If you cannot upgrade, disable recovery mode or block network access to the recovery endpoints.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6553
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-63132
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63132

## From the sources

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao's handleLogicalRecovery path in http/logical.go compared the highly privileged recovery token with ordinary string equality. A remote unauthenticated attacker able to make repeated recovery mode requests and measure response timing could infer the recovery token. The recovered token could then authorize recovery mode operations that read or modify OpenBao data. This issue is fixed in version 2.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_